@getstrata/bootstrap 0.2.4 → 0.2.6

package/dist/index.js

@@ -81,9 +81,6 @@ var databaseConfig = {
 // ../../src/core/database/connectionContext.ts
 import { AsyncLocalStorage } from "async_hooks";
 var activeConnection = new AsyncLocalStorage;
-function runWithDatabaseConnection(connection, callback) {
-  return activeConnection.run(connection, callback);
-}
 function getActiveDatabaseConnection(fallback) {
   return activeConnection.getStore() ?? fallback;
 }
@@ -207,12 +204,6 @@ class UnauthorizedError extends HttpError {
   }
 }
 
-class PayloadTooLargeError extends HttpError {
-  constructor(message = "Payload Too Large", details) {
-    super(413, message, details);
-  }
-}
-
 // ../../src/core/security/safeUrl.ts
 var BLOCKED_HOSTNAMES = new Set([
   "localhost",
@@ -836,9 +827,6 @@ var tokenServiceToken = CORE_TOKEN_SERVICE_TOKEN;
 // ../../src/core/auth/authContext.ts
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
 var authContext = new AsyncLocalStorage2;
-function runWithAuthUser(user, callback) {
-  return authContext.run(user, callback);
-}
 function currentAuthUser() {
   return authContext.getStore() ?? null;
 }
@@ -2347,6 +2335,39 @@ function indexBelongsToRelation(children, parents, relation) {
   }
   return result;
 }
+function indexMorphManyRelation(parents, children, relation) {
+  const groups = new Map;
+  for (const parent of parents) {
+    groups.set(parent[relation.localKey], []);
+  }
+  for (const child of children) {
+    if (child[relation.morphTypeKey] !== relation.morphType) {
+      continue;
+    }
+    const key = child[relation.morphIdKey];
+    const group = groups.get(key);
+    if (!group) {
+      continue;
+    }
+    group.push(child);
+  }
+  return groups;
+}
+function indexMorphToRelation(children, parentsByType, relation) {
+  const result = new Map;
+  for (const child of children) {
+    const morphType = String(child[relation.morphTypeKey]);
+    const parents = parentsByType.get(morphType);
+    if (!parents) {
+      continue;
+    }
+    const parent = parents.get(child[relation.morphIdKey]);
+    if (parent) {
+      result.set(child[relation.morphIdKey], parent);
+    }
+  }
+  return result;
+}
 
 // ../../src/core/database/boundConnection.ts
 var boundConnectionHolder = {
@@ -2477,6 +2498,37 @@ class RepositoryQuery {
     });
     return this;
   }
+  withMorphMany(as, relation, childRepository, options = {}) {
+    this.eagerLoads.push({
+      kind: "morphMany",
+      as,
+      relation,
+      repository: childRepository,
+      options
+    });
+    return this;
+  }
+  withMorphOne(as, relation, childRepository, options = {}) {
+    this.eagerLoads.push({
+      kind: "morphOne",
+      as,
+      relation,
+      repository: childRepository,
+      options
+    });
+    return this;
+  }
+  withMorphTo(as, relation, repositoriesByType, options = {}) {
+    this.eagerLoads.push({
+      kind: "morphTo",
+      as,
+      relation,
+      repository: this.repository,
+      morphRepositories: repositoriesByType,
+      options
+    });
+    return this;
+  }
   async get() {
     const rows = await this.repository.findAll(this.buildOptions());
     return await this.attach(rows);
@@ -2537,6 +2589,33 @@ class RepositoryQuery {
         }));
         continue;
       }
+      if (load.kind === "morphMany") {
+        const relation2 = load.relation;
+        const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadMorphManyForParents(rows, relation2, load.options);
+        result = result.map((row) => ({
+          ...row,
+          [load.as]: grouped2.get(row[relation2.localKey]) ?? []
+        }));
+        continue;
+      }
+      if (load.kind === "morphOne") {
+        const relation2 = load.relation;
+        const grouped2 = await load.repository.withConnection(this.repository.getConnection()).loadMorphOneForParents(rows, relation2, load.options);
+        result = result.map((row) => ({
+          ...row,
+          [load.as]: grouped2.get(row[relation2.localKey])
+        }));
+        continue;
+      }
+      if (load.kind === "morphTo") {
+        const relation2 = load.relation;
+        const grouped2 = await this.repository.loadMorphToForChildren(rows, relation2, load.morphRepositories ?? new Map, load.options);
+        result = result.map((row) => ({
+          ...row,
+          [load.as]: grouped2.get(row[relation2.morphIdKey])
+        }));
+        continue;
+      }
       const relation = load.relation;
       const grouped = await this.repository.loadBelongsToForParents(rows, relation, load.repository, load.options);
       result = result.map((row) => ({
@@ -2813,6 +2892,56 @@ class BaseRepository5 {
     }, options);
     return indexBelongsToRelation(children, parents, relation);
   }
+  async loadMorphManyForParents(parents, relation, options = {}) {
+    if (parents.length === 0) {
+      return indexMorphManyRelation(parents, [], relation);
+    }
+    const parentIds = [...new Set(parents.map((parent) => parent[relation.localKey]))];
+    const children = await this.findWhere({
+      [relation.morphTypeKey]: relation.morphType,
+      [relation.morphIdKey]: parentIds
+    }, options);
+    return indexMorphManyRelation(parents, children, relation);
+  }
+  async loadMorphOneForParents(parents, relation, options = {}) {
+    const grouped = await this.loadMorphManyForParents(parents, relation, options);
+    const result = new Map;
+    for (const parent of parents) {
+      const matches = grouped.get(parent[relation.localKey]) ?? [];
+      result.set(parent[relation.localKey], matches[0]);
+    }
+    return result;
+  }
+  async loadMorphToForChildren(children, relation, repositoriesByType, options = {}) {
+    if (children.length === 0) {
+      return new Map;
+    }
+    const idsByType = new Map;
+    for (const child of children) {
+      const morphType = String(child[relation.morphTypeKey]);
+      const morphId = child[relation.morphIdKey];
+      const ids = idsByType.get(morphType) ?? new Set;
+      ids.add(morphId);
+      idsByType.set(morphType, ids);
+    }
+    const parentsByType = new Map;
+    for (const [morphType, ids] of idsByType) {
+      const repository = repositoriesByType.get(morphType);
+      if (!repository) {
+        continue;
+      }
+      const ownerKey = repository.getTable().primaryKey;
+      const parents = await repository.withConnection(this.connection).findWhere({
+        [ownerKey]: [...ids]
+      }, options);
+      const indexed = new Map;
+      for (const parent of parents) {
+        indexed.set(parent[ownerKey], parent);
+      }
+      parentsByType.set(morphType, indexed);
+    }
+    return indexMorphToRelation(children, parentsByType, relation);
+  }
 }
 var baseRepository_default = BaseRepository5;
 // ../../src/core/database/model.ts
@@ -3429,6 +3558,12 @@ class FailedJobService {
     await this.repository.deleteById(id);
     return failedJob;
   }
+  async delete(id) {
+    const deleted = await this.repository.deleteById(id);
+    if (!deleted) {
+      throw new Error(`Failed job ${id} not found.`);
+    }
+  }
   async flush() {
     const jobs = await this.repository.findAll();
     let deleted = 0;
@@ -3442,9 +3577,6 @@ class FailedJobService {
 }
 var failedJobService_default = FailedJobService;
 
-// ../../src/core/queue/redisQueue.ts
-var {RedisClient: RedisClient2 } = globalThis.Bun;
-
 // ../../src/core/queue/jobRunner.ts
 async function runQueueJob(envelope, failedJobs) {
   const job = jobRegistry.create(envelope.name);
@@ -3476,6 +3608,7 @@ async function runQueueJob(envelope, failedJobs) {
 }
 
 // ../../src/core/queue/redisQueue.ts
+var {RedisClient: RedisClient2 } = globalThis.Bun;
 var QUEUE_LIST_KEY = "workhub:queue:default";
 var QUEUE_HIGH_KEY = "workhub:queue:high";
 var QUEUE_LOW_KEY = "workhub:queue:low";
@@ -3584,8 +3717,14 @@ function registerInvalidateCacheOnModelWriteListeners(bus = eventBus) {
         if (tags.length === 0) {
           return;
         }
-        const cache = resolveApplicationCache();
-        const queue = resolveApplicationQueue();
+        let cache;
+        let queue;
+        try {
+          cache = resolveApplicationCache();
+          queue = resolveApplicationQueue();
+        } catch {
+          return;
+        }
         const job = createTrackedJob("cache.invalidate-tags", new invalidateCacheTagsJob_default(cache));
         await queue.dispatch(job, { tags });
       });
@@ -3695,9 +3834,6 @@ function isViewsEnabled() {
 // ../../src/core/http/requestMetaContext.ts
 import { AsyncLocalStorage as AsyncLocalStorage3 } from "async_hooks";
 var requestMetaContext = new AsyncLocalStorage3;
-function runWithRequestMeta(meta, callback) {
-  return requestMetaContext.run(meta, callback);
-}
 function currentRequestMeta() {
   return requestMetaContext.getStore() ?? {
     ipAddress: null,
@@ -3747,9 +3883,6 @@ function htmlResponse(html, init = {}) {
     }
   });
 }
-// ../../src/core/http/csrfToken.ts
-import { timingSafeEqual as timingSafeEqual2 } from "crypto";
-
 // ../../src/core/http/cookies.ts
 function readRequestCookie(request, name) {
   const cookies = request.cookies;
@@ -3784,14 +3917,6 @@ function resolveCsrfSecret() {
 function csrfVerifyOptions() {
   return { secret: resolveCsrfSecret(), maxAge: CSRF_TTL_MS };
 }
-function tokensMatch(left, right) {
-  const leftBuffer = Buffer.from(left);
-  const rightBuffer = Buffer.from(right);
-  if (leftBuffer.length !== rightBuffer.length) {
-    return false;
-  }
-  return timingSafeEqual2(leftBuffer, rightBuffer);
-}
 function createCsrfTokenCookie() {
   const token = Bun.CSRF.generate(resolveCsrfSecret(), { expiresIn: CSRF_TTL_MS });
   return {
@@ -3806,45 +3931,6 @@ function resolveCsrfToken(request) {
   }
   return createCsrfTokenCookie();
 }
-function readSubmittedCsrfToken(request) {
-  const headerToken = request.headers.get("x-csrf-token")?.trim();
-  if (headerToken) {
-    return headerToken;
-  }
-  return null;
-}
-async function readSubmittedCsrfTokenFromBody(request) {
-  const headerToken = readSubmittedCsrfToken(request);
-  if (headerToken) {
-    return headerToken;
-  }
-  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-    const formData = await request.clone().formData();
-    const field = formData.get("_token");
-    if (typeof field === "string" && field.trim().length > 0) {
-      return field.trim();
-    }
-    const legacyField = formData.get("_csrf");
-    if (typeof legacyField === "string" && legacyField.trim().length > 0) {
-      return legacyField.trim();
-    }
-  }
-  return null;
-}
-function verifyCsrfToken(request, submittedToken) {
-  if (!submittedToken) {
-    return false;
-  }
-  const cookieValue = readRequestCookie(request, CSRF_COOKIE);
-  if (!cookieValue) {
-    return false;
-  }
-  if (!tokensMatch(submittedToken, cookieValue)) {
-    return false;
-  }
-  return Bun.CSRF.verify(submittedToken, csrfVerifyOptions());
-}
 function resolveCsrfTokenForRequest(request) {
   const metaToken = currentRequestMeta().csrfToken;
   if (metaToken) {
@@ -3854,7 +3940,7 @@ function resolveCsrfTokenForRequest(request) {
 }
 
 // ../../src/core/http/flashSession.ts
-import { createHmac as createHmac3, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import { createHmac as createHmac3, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var FLASH_COOKIE = "workhub_flash";
 var FLASH_TTL_MS = 60 * 1000;
 function resolveFlashSecret() {
@@ -3901,7 +3987,7 @@ function parseFlashCookie(cookieValue) {
   if (expectedBuffer.length !== actualBuffer.length) {
     return null;
   }
-  if (!timingSafeEqual3(expectedBuffer, actualBuffer)) {
+  if (!timingSafeEqual2(expectedBuffer, actualBuffer)) {
     return null;
   }
   try {
@@ -3917,9 +4003,6 @@ function parseFlashCookie(cookieValue) {
     return null;
   }
 }
-function clearFlashCookie() {
-  return `${FLASH_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;
-}
 function pullFlash(request) {
   const cookieValue = readFlashCookie(request);
   if (!cookieValue) {
@@ -3927,15 +4010,6 @@ function pullFlash(request) {
   }
   return parseFlashCookie(cookieValue);
 }
-function withFlashClear(response) {
-  const headers = new Headers(response.headers);
-  headers.append("set-cookie", clearFlashCookie());
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
 
 // ../../src/core/view/webLayoutData.ts
 async function resolveWebLayoutData(container, request) {
@@ -4127,17 +4201,6 @@ function composeMiddleware(...middleware) {
     };
   };
 }
-async function requestIdMiddleware(request, next) {
-  const requestId = request.headers.get("x-request-id") ?? crypto.randomUUID();
-  const response = await next();
-  const headers = new Headers(response.headers);
-  headers.set("x-request-id", requestId);
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
 function wrapRouteHandler(handler, middleware) {
   if (isMethodRouteMap(handler)) {
     const wrapped = {};
@@ -4159,6 +4222,32 @@ function applyMiddlewareToRoutes(routes, middleware) {
   return wrapped;
 }
 
+// ../../src/bootstrap/httpKernel.ts
+import {
+  createAuthMiddleware,
+  createAuthorizeMiddleware,
+  createBodySizeLimitMiddleware,
+  createCorsMiddleware,
+  createCsrfMiddleware,
+  createFlashMiddleware,
+  createLoginThrottleMiddleware,
+  createMembershipMiddleware,
+  createMemoryThrottleMiddleware,
+  createMetricsMiddleware,
+  createRequestLoggingMiddleware,
+  createRequireAbilityMiddleware,
+  createRequireAuthMiddleware,
+  createRequireGlobalAdminMiddleware,
+  createRequireWebAuthMiddleware,
+  createSecurityHeadersMiddleware,
+  createTenantMiddleware,
+  createThrottleMiddleware,
+  createTracingMiddleware,
+  isPublicReadsEnabled,
+  requestIdMiddleware,
+  withMiddleware
+} from "@getstrata/core";
+
 // ../../src/config/rateLimit.ts
 var LOCAL_LOGIN_RATE_LIMIT = {
   maxAttempts: 100,
@@ -4193,849 +4282,6 @@ function resolveRegisterRateLimit() {
   };
 }
 
-// ../../src/core/auth/membershipContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage4 } from "async_hooks";
-
-// ../../src/modules/organization/memberRepository.ts
-class OrganizationMemberRepository {
-  constructor() {}
-  async findMembership(userId, organizationId) {
-    const rows = await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE user_id = ${userId} AND organization_id = ${organizationId}
-      LIMIT 1
-    `;
-    return rows[0] ?? null;
-  }
-  async listForUser(userId) {
-    return await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE user_id = ${userId}
-      ORDER BY organization_id
-    `;
-  }
-  async listForOrganization(organizationId) {
-    return await connection_default`
-      SELECT id, organization_id, user_id, role, created_at
-      FROM organization_member
-      WHERE organization_id = ${organizationId}
-      ORDER BY id
-    `;
-  }
-  async addMember(input) {
-    const rows = await connection_default`
-      INSERT INTO organization_member (organization_id, user_id, role)
-      VALUES (${input.organizationId}, ${input.userId}, ${input.role ?? "member"})
-      RETURNING id, organization_id, user_id, role, created_at
-    `;
-    const row = rows[0];
-    if (!row) {
-      throw new Error("Organization member insert did not return a row.");
-    }
-    return row;
-  }
-  async removeMember(organizationId, userId) {
-    const rows = await connection_default`
-      DELETE FROM organization_member
-      WHERE organization_id = ${organizationId} AND user_id = ${userId}
-      RETURNING id
-    `;
-    return rows.length > 0;
-  }
-}
-var memberRepository_default = OrganizationMemberRepository;
-
-// ../../src/core/auth/accessControl.ts
-function isGlobalAdmin(user) {
-  return user?.role === "admin";
-}
-function resolveUserId(user) {
-  const userId = typeof user.id === "number" ? user.id : Number(user.id);
-  if (!Number.isInteger(userId) || userId <= 0) {
-    throw new ForbiddenError("Invalid authenticated user.");
-  }
-  return userId;
-}
-
-// ../../src/core/auth/membershipContext.ts
-var membershipContext = new AsyncLocalStorage4;
-var membershipRepository = new memberRepository_default;
-async function runWithMembershipContext(callback) {
-  const user = currentAuthUser();
-  if (!user || isGlobalAdmin(user)) {
-    return await callback();
-  }
-  const memberships = await membershipRepository.listForUser(resolveUserId(user));
-  const context = {
-    organizationIds: memberships.map((membership) => membership.organization_id),
-    rolesByOrganizationId: new Map(memberships.map((membership) => [membership.organization_id, membership.role]))
-  };
-  return await membershipContext.run(context, callback);
-}
-
-// ../../src/core/auth/membershipContextMiddleware.ts
-function createMembershipContextMiddleware() {
-  return async (_request, next) => {
-    return await runWithMembershipContext(async () => await next());
-  };
-}
-
-// ../../src/core/auth/membershipMiddleware.ts
-function createMembershipMiddleware() {
-  return createMembershipContextMiddleware();
-}
-
-// ../../src/core/http/authMiddleware.ts
-function createAuthMiddleware(auth) {
-  return async (request, next) => {
-    const user = await auth.resolve(request);
-    return await runWithAuthUser(user, async () => {
-      const response = await next();
-      if (user) {
-        const headers = new Headers(response.headers);
-        headers.set("x-authenticated-user-id", String(user.id));
-        return new Response(response.body, {
-          status: response.status,
-          statusText: response.statusText,
-          headers
-        });
-      }
-      return response;
-    });
-  };
-}
-
-// ../../src/core/http/authorizeMiddleware.ts
-function createAuthorizeMiddleware(gate, auth, resource, action) {
-  return async (request, next) => {
-    const user = await auth.resolve(request);
-    if (!gate.allows(resource, action, user)) {
-      const error = new ForbiddenError;
-      return Response.json({ error: error.message }, { status: error.status });
-    }
-    return await next();
-  };
-}
-
-// ../../src/core/http/bodySizeLimitMiddleware.ts
-var DEFAULT_MAX_BODY_BYTES = 1048576;
-function resolveMaxBodyBytes() {
-  const raw = process.env.MAX_REQUEST_BODY_BYTES?.trim();
-  if (!raw) {
-    return DEFAULT_MAX_BODY_BYTES;
-  }
-  const parsed = Number.parseInt(raw, 10);
-  if (!Number.isInteger(parsed) || parsed <= 0) {
-    return DEFAULT_MAX_BODY_BYTES;
-  }
-  return parsed;
-}
-function createBodySizeLimitMiddleware(maxBytes = resolveMaxBodyBytes()) {
-  return async (request, next) => {
-    const contentLength = request.headers.get("content-length");
-    if (contentLength) {
-      const bytes = Number.parseInt(contentLength, 10);
-      if (Number.isInteger(bytes) && bytes > maxBytes) {
-        const error = new PayloadTooLargeError(`Request body exceeds the ${maxBytes} byte limit.`);
-        return Response.json({ error: error.message }, { status: error.status });
-      }
-    }
-    return await next();
-  };
-}
-
-// ../../src/config/cors.ts
-var corsConfig = {
-  allowedOrigins: (process.env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim()).filter(Boolean),
-  allowedMethods: ["GET", "POST", "PATCH", "PUT", "DELETE", "OPTIONS"],
-  allowedHeaders: [
-    "Authorization",
-    "Content-Type",
-    "X-Request-Id",
-    "X-Tenant-Id",
-    "X-Authenticated-User-Id",
-    "X-Authenticated-User-Role",
-    "If-Match",
-    "If-None-Match"
-  ],
-  maxAgeSeconds: 86400
-};
-
-// ../../src/core/http/corsMiddleware.ts
-function createCorsMiddleware() {
-  return async (request, next) => {
-    if (request.method === "OPTIONS") {
-      return new Response(null, {
-        status: 204,
-        headers: buildCorsHeaders(request)
-      });
-    }
-    const response = await next();
-    const headers = new Headers(response.headers);
-    for (const [key, value] of buildCorsHeaders(request)) {
-      headers.set(key, value);
-    }
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers
-    });
-  };
-}
-function buildCorsHeaders(request) {
-  const headers = new Headers;
-  const origin = request.headers.get("origin");
-  const allowedOrigins = corsConfig.allowedOrigins;
-  const allowOrigin = allowedOrigins.includes("*") || origin && allowedOrigins.includes(origin) ? origin ?? "*" : allowedOrigins[0] ?? "*";
-  headers.set("Access-Control-Allow-Origin", allowOrigin);
-  headers.set("Access-Control-Allow-Methods", corsConfig.allowedMethods.join(", "));
-  headers.set("Access-Control-Allow-Headers", corsConfig.allowedHeaders.join(", "));
-  headers.set("Access-Control-Max-Age", String(corsConfig.maxAgeSeconds));
-  headers.set("Vary", "Origin");
-  return headers;
-}
-
-// ../../src/core/http/csrfMiddleware.ts
-var MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
-function appendSetCookie(response, cookie) {
-  const headers = new Headers(response.headers);
-  headers.append("set-cookie", cookie);
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
-function createCsrfMiddleware() {
-  return async (request, next) => {
-    const method = request.method.toUpperCase();
-    if (!MUTATING_METHODS.has(method)) {
-      const csrf = resolveCsrfToken(request);
-      const meta = currentRequestMeta();
-      meta.csrfToken = csrf.token;
-      const response = await next();
-      if (!csrf.cookie) {
-        return response;
-      }
-      return appendSetCookie(response, csrf.cookie);
-    }
-    const submitted = await readSubmittedCsrfTokenFromBody(request);
-    if (!verifyCsrfToken(request, submitted)) {
-      throw new ForbiddenError("Invalid or missing CSRF token.");
-    }
-    return await next();
-  };
-}
-
-// ../../src/core/http/flashMiddleware.ts
-function createFlashMiddleware() {
-  return async (request, next) => {
-    const flash = pullFlash(request);
-    const meta = currentRequestMeta();
-    return await runWithRequestMeta({ ...meta, request, flash }, async () => {
-      const response = await next();
-      if (flash) {
-        return withFlashClear(response);
-      }
-      return response;
-    });
-  };
-}
-
-// ../../src/core/http/loginThrottleMiddleware.ts
-var {RedisClient: RedisClient3 } = globalThis.Bun;
-function resolveLoginIdentity(request) {
-  return request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
-}
-async function resolveLoginEmail(request) {
-  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  try {
-    if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-      const formData = await request.clone().formData();
-      const email = formData.get("email");
-      return typeof email === "string" ? email.trim().toLowerCase() : "unknown";
-    }
-    const payload = await request.clone().json();
-    return typeof payload.email === "string" ? payload.email.trim().toLowerCase() : "unknown";
-  } catch {
-    return "unknown";
-  }
-}
-function createLoginThrottleMiddleware(options) {
-  const client = new RedisClient3(options.redisUrl);
-  const prefix = options.keyPrefix ?? "workhub:login-throttle:";
-  return async (request, next) => {
-    const identity = resolveLoginIdentity(request);
-    const email = await resolveLoginEmail(request);
-    const throttleKey = `${prefix}${identity}:${email}`;
-    const attempts = Number(await client.incr(throttleKey));
-    if (attempts === 1) {
-      await client.expire(throttleKey, options.decaySeconds);
-    }
-    if (attempts > options.maxAttempts) {
-      return Response.json({ error: "Too many login attempts. Try again later." }, {
-        status: 429,
-        headers: {
-          "retry-after": String(options.decaySeconds)
-        }
-      });
-    }
-    return await next();
-  };
-}
-
-// ../../src/core/http/memoryThrottleMiddleware.ts
-var buckets = new Map;
-function createMemoryThrottleMiddleware(options) {
-  const prefix = options.keyPrefix ?? "workhub:memory-throttle:";
-  return async (request, next) => {
-    const path = new URL(request.url).pathname;
-    const identity = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? request.headers.get("authorization")?.slice(0, 32) ?? "unknown";
-    const key = `${prefix}${identity}:${path}`;
-    const now = Date.now();
-    const existing = buckets.get(key);
-    if (!existing || existing.resetAt <= now) {
-      buckets.set(key, { count: 1, resetAt: now + options.decaySeconds * 1000 });
-      return await next();
-    }
-    existing.count += 1;
-    if (existing.count > options.maxAttempts) {
-      return Response.json({ error: "Too many requests." }, {
-        status: 429,
-        headers: {
-          "retry-after": String(options.decaySeconds)
-        }
-      });
-    }
-    return await next();
-  };
-}
-
-// ../../src/core/metrics/prometheus.ts
-class PrometheusRegistry {
-  httpRequestsTotal = new Map;
-  httpRequestDurationMs = new Map;
-  incrementHttpRequest(labels) {
-    const key = this.metricKey(labels);
-    this.httpRequestsTotal.set(key, (this.httpRequestsTotal.get(key) ?? 0) + 1);
-  }
-  observeHttpDuration(labels, durationMs) {
-    const key = this.metricKey(labels);
-    const samples = this.httpRequestDurationMs.get(key) ?? [];
-    samples.push(durationMs);
-    this.httpRequestDurationMs.set(key, samples);
-  }
-  renderMetrics() {
-    const lines = [
-      "# HELP http_requests_total Total HTTP requests processed.",
-      "# TYPE http_requests_total counter"
-    ];
-    for (const [key, value] of this.httpRequestsTotal) {
-      lines.push(`http_requests_total{${key}} ${value}`);
-    }
-    lines.push("# HELP http_request_duration_ms_sum Sum of HTTP request durations in milliseconds.", "# TYPE http_request_duration_ms_sum counter");
-    for (const [key, samples] of this.httpRequestDurationMs) {
-      const sum = samples.reduce((total, sample) => total + sample, 0);
-      lines.push(`http_request_duration_ms_sum{${key}} ${sum}`);
-    }
-    return `${lines.join(`
-`)}
-`;
-  }
-  resetForTests() {
-    this.httpRequestsTotal.clear();
-    this.httpRequestDurationMs.clear();
-  }
-  getHttpRequestSummary() {
-    const byStatus = {};
-    const pathCounts = new Map;
-    let totalRequests = 0;
-    for (const [key, count] of this.httpRequestsTotal) {
-      totalRequests += count;
-      const method = key.match(/method="([^"]+)"/)?.[1] ?? "GET";
-      const path = key.match(/path="([^"]+)"/)?.[1] ?? "/";
-      const status = key.match(/status="([^"]+)"/)?.[1] ?? "200";
-      byStatus[status] = (byStatus[status] ?? 0) + count;
-      const pathKey = `${method} ${path}`;
-      const existing = pathCounts.get(pathKey);
-      if (existing) {
-        existing.count += count;
-      } else {
-        pathCounts.set(pathKey, { method, path, count });
-      }
-    }
-    const topPaths = Array.from(pathCounts.values()).sort((left, right) => right.count - left.count).slice(0, 10);
-    return {
-      totalRequests,
-      byStatus,
-      topPaths
-    };
-  }
-  metricKey(labels) {
-    return `method="${labels.method}",path="${labels.path}",status="${labels.status}"`;
-  }
-}
-var prometheusRegistry = new PrometheusRegistry;
-
-// ../../src/core/http/metricsMiddleware.ts
-function normalizeMetricPath(pathname) {
-  return pathname.replace(/\/\d+/g, "/:id").replace(/\/[0-9a-f-]{36}/gi, "/:id");
-}
-function createMetricsMiddleware() {
-  return async (request, next) => {
-    const startedAt = performance.now();
-    const response = await next();
-    const durationMs = performance.now() - startedAt;
-    const path = normalizeMetricPath(new URL(request.url).pathname);
-    const labels = {
-      method: request.method,
-      path,
-      status: String(response.status)
-    };
-    prometheusRegistry.incrementHttpRequest(labels);
-    prometheusRegistry.observeHttpDuration(labels, durationMs);
-    return response;
-  };
-}
-
-// ../../src/core/http/requireAbilityMiddleware.ts
-function createRequireAbilityMiddleware(abilityChecker) {
-  return (ability) => {
-    return async (_request, next) => {
-      const user = currentAuthUser();
-      try {
-        abilityChecker.requireAbility(user, ability);
-      } catch (error) {
-        if (error instanceof ForbiddenError) {
-          return Response.json({ error: error.message }, { status: error.status });
-        }
-        throw error;
-      }
-      return await next();
-    };
-  };
-}
-
-// ../../src/core/http/requireAuthMiddleware.ts
-function createRequireAuthMiddleware(auth) {
-  return async (request, next) => {
-    if (!await auth.check(request)) {
-      const error = new UnauthorizedError;
-      return Response.json({ error: error.message }, { status: error.status });
-    }
-    return await next();
-  };
-}
-
-// ../../src/core/security/securityEvents.ts
-function logSecurityEvent2(event, details = {}) {
-  const meta = currentRequestMeta();
-  const user = currentAuthUser();
-  console.log(JSON.stringify({
-    level: "security",
-    event,
-    timestamp: new Date().toISOString(),
-    ip_address: meta.ipAddress ?? null,
-    user_agent: meta.userAgent ?? null,
-    user_id: user?.id ?? null,
-    ...details
-  }));
-}
-
-// ../../src/core/http/requireGlobalAdminMiddleware.ts
-function createRequireGlobalAdminMiddleware() {
-  return async (_request, next) => {
-    const user = currentAuthUser();
-    if (!isGlobalAdmin(user)) {
-      logSecurityEvent2("privilege_escalation_blocked", {
-        required_role: "platform_admin",
-        path: new URL(_request.url).pathname
-      });
-      const error = new ForbiddenError("Platform admin access required.");
-      return Response.json({ error: error.message }, { status: error.status });
-    }
-    return await next();
-  };
-}
-
-// ../../src/core/http/contentNegotiation.ts
-function requestPrefersJson(request) {
-  if (!request) {
-    return true;
-  }
-  if (request.headers.get("HX-Request") === "true") {
-    return false;
-  }
-  const accept = request.headers.get("accept")?.toLowerCase() ?? "";
-  if (accept.includes("text/html")) {
-    return false;
-  }
-  if (accept.includes("application/json")) {
-    return true;
-  }
-  const contentType = request.headers.get("content-type")?.toLowerCase() ?? "";
-  if (contentType.includes("application/x-www-form-urlencoded") || contentType.includes("multipart/form-data")) {
-    return false;
-  }
-  const pathname = new URL(request.url).pathname;
-  return pathname.startsWith("/api/");
-}
-
-// ../../src/core/http/requireWebAuthMiddleware.ts
-function createRequireWebAuthMiddleware(auth) {
-  return async (request, next) => {
-    const user = await auth.resolve(request);
-    if (user) {
-      return await next();
-    }
-    if (requestPrefersJson(request)) {
-      throw new UnauthorizedError;
-    }
-    const redirectTarget = encodeURIComponent(new URL(request.url).pathname);
-    return Response.redirect(`/login?redirect=${redirectTarget}`, 302);
-  };
-}
-
-// ../../src/core/http/routeMiddleware.ts
-function withMiddleware(...middleware) {
-  const wrap = composeMiddleware(...middleware);
-  return (handler) => {
-    return wrap(handler);
-  };
-}
-
-// ../../src/config/contentSecurityPolicy.ts
-function strictApiContentSecurityPolicy() {
-  return "default-src 'none'; frame-ancestors 'none'; base-uri 'none'";
-}
-function serverHtmxContentSecurityPolicy() {
-  return [
-    "default-src 'self'",
-    "script-src 'self' https://unpkg.com",
-    "style-src 'self'",
-    "connect-src 'self'",
-    "img-src 'self'",
-    "font-src 'self'",
-    "form-action 'self'",
-    "frame-ancestors 'none'",
-    "base-uri 'self'"
-  ].join("; ");
-}
-function spaContentSecurityPolicy() {
-  return [
-    "default-src 'self'",
-    "script-src 'self'",
-    "style-src 'self'",
-    "connect-src 'self'",
-    "img-src 'self'",
-    "font-src 'self'",
-    "frame-ancestors 'none'",
-    "base-uri 'self'"
-  ].join("; ");
-}
-function resolveContentSecurityPolicy(response) {
-  const contentType = response.headers.get("content-type")?.toLowerCase() ?? "";
-  if (!contentType.includes("text/html")) {
-    return strictApiContentSecurityPolicy();
-  }
-  const frontendMode = (process.env.FRONTEND_MODE ?? "api").trim();
-  if (frontendMode === "server-htmx") {
-    return serverHtmxContentSecurityPolicy();
-  }
-  if (frontendMode === "spa-react") {
-    return spaContentSecurityPolicy();
-  }
-  return strictApiContentSecurityPolicy();
-}
-
-// ../../src/core/http/securityHeadersMiddleware.ts
-function createSecurityHeadersMiddleware() {
-  return async (_request, next) => {
-    const response = await next();
-    const headers = new Headers(response.headers);
-    headers.set("X-Content-Type-Options", "nosniff");
-    headers.set("X-Frame-Options", "DENY");
-    headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
-    headers.set("X-XSS-Protection", "0");
-    headers.set("Content-Security-Policy", resolveContentSecurityPolicy(response));
-    if (appConfig.env === "production") {
-      headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
-    }
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers
-    });
-  };
-}
-
-// ../../src/core/http/throttleMiddleware.ts
-var {RedisClient: RedisClient4 } = globalThis.Bun;
-
-// ../../src/core/tenant/tenantContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage5 } from "async_hooks";
-var tenantContext = new AsyncLocalStorage5;
-function runWithTenant(tenant, callback) {
-  return tenantContext.run(tenant, callback);
-}
-function currentTenant() {
-  return tenantContext.getStore() ?? null;
-}
-function rateLimitMultiplierForPlan(plan) {
-  switch (plan) {
-    case "enterprise":
-      return 4;
-    case "pro":
-      return 2;
-    default:
-      return 1;
-  }
-}
-
-// ../../src/core/http/throttleMiddleware.ts
-function resolveThrottleIdentity(request) {
-  const user = currentAuthUser();
-  if (user?.tokenId !== undefined) {
-    return `token:${user.tokenId}`;
-  }
-  if (user) {
-    return `user:${user.id}`;
-  }
-  return request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
-}
-function createThrottleMiddleware(options) {
-  const client = new RedisClient4(options.redisUrl);
-  const prefix = options.keyPrefix ?? "workhub:throttle:";
-  return async (request, next) => {
-    const identity = resolveThrottleIdentity(request);
-    const path = new URL(request.url).pathname;
-    const throttleKey = `${prefix}${identity}:${path}`;
-    const attempts = Number(await client.incr(throttleKey));
-    if (attempts === 1) {
-      await client.expire(throttleKey, options.decaySeconds);
-    }
-    const maxAttempts = options.maxAttempts * rateLimitMultiplierForPlan(currentTenant()?.plan ?? "free");
-    if (attempts > maxAttempts) {
-      return Response.json({ error: "Too many requests." }, {
-        status: 429,
-        headers: {
-          "retry-after": String(options.decaySeconds)
-        }
-      });
-    }
-    return await next();
-  };
-}
-
-// ../../src/core/logging/requestLoggingMiddleware.ts
-function createRequestLoggingMiddleware() {
-  return async (request, next) => {
-    return await runWithRequestMeta({
-      ipAddress: request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? request.headers.get("x-real-ip"),
-      userAgent: request.headers.get("user-agent"),
-      request
-    }, async () => {
-      const startedAt = performance.now();
-      const requestId = request.headers.get("x-request-id") ?? crypto.randomUUID();
-      const response = await next();
-      const durationMs = Math.round(performance.now() - startedAt);
-      appLogger.info("HTTP request completed", {
-        requestId,
-        method: request.method,
-        path: new URL(request.url).pathname,
-        status: response.status,
-        durationMs
-      });
-      return response;
-    });
-  };
-}
-
-// ../../src/core/security/publicReads.ts
-function isPublicReadsEnabled() {
-  return isFeatureEnabled("publicReads");
-}
-
-// ../../src/core/tenant/resolveTenant.ts
-async function resolveTenant(tenantId) {
-  const rows = await connection_default`
-    SELECT id, slug, plan, region
-    FROM tenant
-    WHERE id = ${tenantId}
-    LIMIT 1
-  `;
-  const row = rows[0];
-  return row ? { id: row.id, slug: row.slug, plan: row.plan, region: row.region ?? "eu" } : null;
-}
-
-// ../../src/core/tenant/tenantDatabaseScope.ts
-async function applyTenantContextToTransaction(transaction, tenantId) {
-  await transaction.unsafe(`SELECT set_config('app.tenant_id', $1, true)`, [String(tenantId)]);
-  await transaction.unsafe(`SELECT set_config('app.bypass_rls', $1, true)`, ["false"]);
-}
-async function runWithTenantDatabase(tenant, callback) {
-  return await getDatabase().begin(async (transaction) => {
-    await applyTenantContextToTransaction(transaction, tenant.id);
-    return await runWithDatabaseConnection(transaction, async () => {
-      return await runWithTenant(tenant, callback);
-    });
-  });
-}
-
-// ../../src/core/tenant/tenantMiddleware.ts
-var DEFAULT_TENANT = {
-  id: 1,
-  slug: "default",
-  plan: "enterprise",
-  region: "eu"
-};
-async function resolveUserTenantId(userId) {
-  return await runWithMigrationBypass(async () => {
-    const rows = await connection_default`
-      SELECT tenant_id
-      FROM users
-      WHERE id = ${userId}
-      LIMIT 1
-    `;
-    return rows[0]?.tenant_id ?? DEFAULT_TENANT.id;
-  });
-}
-async function resolveTenantForRequest(request) {
-  const user = currentAuthUser();
-  const headerValue = request.headers.get("x-tenant-id")?.trim();
-  const parsedHeader = headerValue !== undefined && headerValue.length > 0 ? Number.parseInt(headerValue, 10) : Number.NaN;
-  if (user) {
-    const userId = typeof user.id === "number" ? user.id : Number.parseInt(String(user.id), 10);
-    if (Number.isInteger(userId) && userId > 0) {
-      const userTenantId = await resolveUserTenantId(userId);
-      if (!isGlobalAdmin(user)) {
-        if (Number.isInteger(parsedHeader) && parsedHeader > 0 && parsedHeader !== userTenantId) {
-          throw new ForbiddenError("Tenant header does not match your account.");
-        }
-        return await resolveTenant(userTenantId) ?? DEFAULT_TENANT;
-      }
-      if (Number.isInteger(parsedHeader) && parsedHeader > 0) {
-        return await resolveTenant(parsedHeader) ?? DEFAULT_TENANT;
-      }
-      return await resolveTenant(userTenantId) ?? DEFAULT_TENANT;
-    }
-  }
-  const tenantId = Number.isInteger(parsedHeader) && parsedHeader > 0 ? parsedHeader : DEFAULT_TENANT.id;
-  return await resolveTenant(tenantId) ?? DEFAULT_TENANT;
-}
-function createTenantMiddleware() {
-  return async (request, next) => {
-    try {
-      const tenant = await resolveTenantForRequest(request);
-      return await runWithTenantDatabase(tenant, async () => {
-        const response = await next();
-        const headers = new Headers(response.headers);
-        headers.set("x-tenant-id", String(tenant.id));
-        headers.set("x-tenant-region", tenant.region);
-        return new Response(response.body, {
-          status: response.status,
-          statusText: response.statusText,
-          headers
-        });
-      });
-    } catch (error) {
-      if (error instanceof HttpError) {
-        return Response.json({ error: error.message }, { status: error.status });
-      }
-      throw error;
-    }
-  };
-}
-
-// ../../src/core/tracing/otel.ts
-import { randomBytes } from "crypto";
-function randomHex(bytes) {
-  return randomBytes(bytes).toString("hex");
-}
-function createSpan(input) {
-  const spanId = randomHex(8);
-  return {
-    traceId: input.traceId,
-    spanId,
-    name: input.name,
-    startTimeUnixNano: String(Math.floor(input.startedAt * 1e6)),
-    endTimeUnixNano: String(Math.floor(input.endedAt * 1e6)),
-    attributes: Object.entries(input.attributes ?? {}).map(([key, value]) => ({
-      key,
-      value: { stringValue: value }
-    })),
-    status: { code: 1 }
-  };
-}
-async function exportOtelSpan(span) {
-  const endpoint = process.env.OTEL_EXPORTER_OTLP_ENDPOINT?.trim();
-  if (!endpoint) {
-    return;
-  }
-  const serviceName = process.env.OTEL_SERVICE_NAME?.trim() ?? "workhub-api";
-  const url = endpoint.endsWith("/v1/traces") ? endpoint : `${endpoint.replace(/\/$/, "")}/v1/traces`;
-  await fetch(url, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({
-      resourceSpans: [
-        {
-          resource: {
-            attributes: [{ key: "service.name", value: { stringValue: serviceName } }]
-          },
-          scopeSpans: [{ spans: [span] }]
-        }
-      ]
-    })
-  });
-}
-
-// ../../src/core/tracing/traceContext.ts
-import { AsyncLocalStorage as AsyncLocalStorage6 } from "async_hooks";
-var traceContextStorage = new AsyncLocalStorage6;
-function runWithTraceContext(context, callback) {
-  return traceContextStorage.run(context, callback);
-}
-
-// ../../src/core/tracing/tracingMiddleware.ts
-function createTracingMiddleware() {
-  return async (request, next) => {
-    const traceId = (request.headers.get("x-trace-id") ?? crypto.randomUUID()).replace(/-/g, "");
-    const spanId = crypto.randomUUID().replace(/-/g, "").slice(0, 16);
-    const startedAt = performance.now();
-    const path = new URL(request.url).pathname;
-    return await runWithTraceContext({ traceId, spanId }, async () => {
-      const response = await next();
-      const endedAt = performance.now();
-      const headers = new Headers(response.headers);
-      headers.set("x-trace-id", traceId);
-      headers.set("x-span-id", spanId);
-      headers.set("traceparent", `00-${traceId}-${spanId}-01`);
-      headers.set("server-timing", `app;dur=${(endedAt - startedAt).toFixed(2)}`);
-      exportOtelSpan(createSpan({
-        traceId,
-        name: `${request.method} ${path}`,
-        startedAt,
-        endedAt,
-        attributes: {
-          "http.method": request.method,
-          "http.route": path,
-          "http.status_code": String(response.status)
-        }
-      })).catch(() => {
-        return;
-      });
-      return new Response(response.body, {
-        status: response.status,
-        statusText: response.statusText,
-        headers
-      });
-    });
-  };
-}
-
 // ../../src/bootstrap/httpKernel.ts
 class HttpKernel {
   dependencies;
@@ -5431,7 +4677,7 @@ function createWebServer(options) {
   });
 }
 // ../../src/bootstrap/web/session.ts
-import { createHash, randomBytes as randomBytes2 } from "crypto";
+import { createHash, randomBytes } from "crypto";
 class CookieSessionStore {
   sql;
   secret;
@@ -5457,7 +4703,7 @@ class CookieSessionStore {
     return header.includes("Secure") ? header : `${header}; Secure`;
   }
   async create(user) {
-    const id = randomBytes2(32).toString("hex");
+    const id = randomBytes(32).toString("hex");
     const expires = new Date(Date.now() + this.maxAgeSeconds * 1000);
     await this.sql.unsafe(`INSERT INTO sessions (id, user_id, expires_at) VALUES ($1, $2, $3)`, [
       id,
@@ -5478,7 +4724,8 @@ class CookieSessionStore {
     if (!sessionId || !signature || signature !== this.sign(sessionId)) {
       return null;
     }
-    const rows = await this.sql.unsafe(`SELECT s.id, s.user_id, s.expires_at, u.name, u.email, u.learn_subscriber
+    const rows = await this.sql.unsafe(`SELECT s.id, s.user_id, s.expires_at, u.name, u.email, u.learn_subscriber,
+              COALESCE(u.is_admin, false) AS is_admin
        FROM sessions s
        INNER JOIN users u ON u.id = s.user_id
        WHERE s.id = $1 AND s.expires_at > NOW()`, [sessionId]);
@@ -5489,7 +4736,8 @@ class CookieSessionStore {
       id: row.user_id,
       name: row.name,
       email: row.email,
-      learn_subscriber: row.learn_subscriber
+      learn_subscriber: row.learn_subscriber,
+      is_admin: row.is_admin
     };
   }
   sign(value) {